diff --git a/.changeset/voice-permission-fallback.md b/.changeset/voice-permission-fallback.md
new file mode 100644
index 000000000..c47389611
--- /dev/null
+++ b/.changeset/voice-permission-fallback.md
@@ -0,0 +1,7 @@
+---
+"@schlessera/brain-ui-sdk": minor
+"@schlessera/brain-ui-react": minor
+"@schlessera/brain-ui-server": minor
+---
+
+Negotiate host permission outcomes in the client and add scoped voice refusals with an earcon and visual fallback when exact permission speech is unproven. Keep approval controls, original-input attribution, once-only cues, terminal and reconnect receipts tied to the host's actual result. Publish posture-denied outcomes without raising a grant card.
diff --git a/api-report/ui-react.txt b/api-report/ui-react.txt
index 22e500eb5..17ba18d43 100644
--- a/api-report/ui-react.txt
+++ b/api-report/ui-react.txt
@@ -833,6 +833,7 @@ signatures (every public export and the types it is made of)
     };
   ToolCall (packages/ui-react/src/stores/chat-state.ts)
     export interface ToolCall {
+        voicePermission?: VoicePermissionReceipt;
         policyChange?: PolicyChangeReview;
         id: string;
         name: string;
@@ -873,6 +874,21 @@ signatures (every public export and the types it is made of)
         enabled?: boolean;
         reload?: () => void;
     }
+  VoicePermissionReceipt (packages/ui-react/src/voice/conversation-permissions.ts)
+    export interface VoicePermissionReceipt {
+        sessionId: string;
+        turnId: string;
+        toolUseId: string;
+        phase: "pending" | "sent" | "unknown" | "denied" | "granted" | "expired";
+        announced: boolean;
+        ambiguous: boolean;
+        byVoice: boolean;
+        heardAt?: number;
+        script: string;
+        word: string;
+        label?: string;
+        postureDenied?: true;
+    }
   VoiceShellState (packages/ui-react/src/stores/shell-stores.ts)
     export interface VoiceShellState {
         readonly mode: VoiceMode;
@@ -1275,6 +1291,21 @@ signatures (every public export and the types it is made of)
             frame: (message: ServerMessage) => ServerMessage | null;
             leave: () => void;
             mute(): void;
+            permissions: {
+                clear(): void;
+                dispose(): void;
+                frame: (message: ServerMessage) => void;
+                input: (event: Extract<import("@schlessera/brain-ui-sdk").ConversationWireEvent, {
+                    kind: "input_fragment";
+                }>) => boolean;
+                lost(): void;
+                quiet: () => void;
+                refresh(): void;
+                state: import("zustand").StoreApi<{
+                    line: string;
+                    records: import("./voice/conversation-permissions.js").VoicePermissionReceipt[];
+                }>;
+            };
             resume(): void;
             start(): void;
             state: import("zustand").StoreApi<import("./voice/conversation-client.js").ConversationClientState>;
@@ -1307,6 +1338,8 @@ signatures (every public export and the types it is made of)
     function flushChatDeltas(): void;
   frame (packages/ui-react/src/voice/conversation-client.ts)
     function frame(message: ServerMessage): ServerMessage | null;
+  frame (packages/ui-react/src/voice/conversation-permissions.ts)
+    function frame(message: ServerMessage): void;
   handleServerMessage (packages/ui-react/src/connection.ts)
     function handleServerMessage(msg: ServerMessage): void;
   hasPendingShare (packages/ui-react/src/stores/share-state.ts)
@@ -1315,10 +1348,16 @@ signatures (every public export and the types it is made of)
     export function hasUnsentText(): boolean;
   inlineMermaidDiagrams (packages/ui-react/src/lib/mermaid.ts)
     export function inlineMermaidDiagrams(markdown: string, theme?: MermaidTheme): Promise<string>;
+  input (packages/ui-react/src/voice/conversation-permissions.ts)
+    function input(event: Extract<ConversationWireEvent, {
+        kind: "input_fragment";
+    }>): boolean;
   leave (packages/ui-react/src/voice/conversation-client.ts)
     function leave(): void;
   logout (packages/ui-react/src/lib/answer-delivery/manager.ts)
     function logout(): Promise<void>;
+  quiet (packages/ui-react/src/voice/conversation-permissions.ts)
+    function quiet(): void;
   receipt (packages/ui-react/src/lib/answer-delivery/manager.ts)
     function receipt(frame: ServerAskAnswerReceipt): void;
   reconnectWebSocketNow (packages/ui-react/src/connection.ts)
diff --git a/docs/decisions/answer-delivery.md b/docs/decisions/answer-delivery.md
index 3730a7ab9..5edc7711c 100644
--- a/docs/decisions/answer-delivery.md
+++ b/docs/decisions/answer-delivery.md
@@ -70,7 +70,7 @@ manufacture an identity, and it was not needed.
 ## One card per request
 
 The store updates a request it already holds and never appends it again
-(`addExchange`, `packages/ui-react/src/stores/chat-state.ts:267-298`). A
+(`addExchange`, `packages/ui-react/src/stores/chat-state.ts:270-301`). A
 settled card stays settled, so a late or replayed frame cannot revive a
 dismissed or answered question. A pending card keeps its payload and the
 exchange object it is keyed by, so a draft in progress survives a re-send.
diff --git a/docs/decisions/design-kit/sessions-and-drafts.md b/docs/decisions/design-kit/sessions-and-drafts.md
index b49bdea4a..577fdffd3 100644
--- a/docs/decisions/design-kit/sessions-and-drafts.md
+++ b/docs/decisions/design-kit/sessions-and-drafts.md
@@ -364,7 +364,7 @@ active; Chat is in the foreground with no panel or other view over it;
 `document.visibilityState` is `visible`; history has a message whose
 host-proven `turnId` equals `latest.turnId`; and that message's last line is
 in the viewport at the bottom, by the same `< 20px` test the transcript uses
-(`const handleScroll`, `packages/ui-react/src/components/chat/chat-page.tsx:273-277`),
+(`const handleScroll`, `packages/ui-react/src/components/chat/chat-page.tsx:274-278`),
 with the scroll disc not drawn. An older key never clears a newer tracker.
 Selecting the session, being scrolled up, a hidden tab, a background buffer
 and the bottom of a replay without the linked turn do not count.
@@ -825,12 +825,12 @@ Read from the source, not inferred from the drawings:
   `cost`. Those props are **new**, and chips get a 44px minimum under a
   coarse pointer (#945).
 - The scroll-to-bottom disc is a bare 32px button with only a `title`
-  (`{showScrollButton && (`, `packages/ui-react/src/components/chat/chat-page.tsx:741-749`).
+  (`{showScrollButton && (`, `packages/ui-react/src/components/chat/chat-page.tsx:742-750`).
   It has no 44px box and no accessible name, so it joins `DiscButton`.
 - **`DiscButton`** is a 32px paint in a 44px box, with `tone: ink | mute`
   and an optional label that expands leftward. It draws exactly three
   discs: the phone Search disc, New chat below 1280
-  (`{hasMessages && !wide && (`, `packages/ui-react/src/components/chat/chat-page.tsx:656-663`)
+  (`{hasMessages && !wide && (`, `packages/ui-react/src/components/chat/chat-page.tsx:657-664`)
   and scroll-to-latest. It is not used for rail rows, pills or chips. Both
   overlay boxes share one vertical range, so #628's resting spacer (`pt-10`
   below an 888px container, not the 880px in the drawings) still clears
diff --git a/docs/decisions/governed-writable-workers.md b/docs/decisions/governed-writable-workers.md
index d3d9979d1..e0e355a57 100644
--- a/docs/decisions/governed-writable-workers.md
+++ b/docs/decisions/governed-writable-workers.md
@@ -163,7 +163,7 @@ still holds.
 **Voice.** Ruling 1 makes voice `governed` too. Voice keeps its narrower
 membership (`VOICE_ALLOWED_TOOLS`, `packages/ui-backend-claude/src/tool-policy.ts:120`):
 no Bash, no raw `Write`/`Edit`, no archive, and approval returns false
-(`const apply = createBrainApplication`, `packages/ui-server/src/ws/bridge.ts:577-581`).
+(`const apply = createBrainApplication`, `packages/ui-server/src/ws/bridge.ts:580-584`).
 A voice turn therefore writes only through curated capture and update, now
 with a journal behind it. The writable mount gives voice no tool it lacked.
 Pi still refuses voice turns.
diff --git a/docs/integration-contract/wire.md b/docs/integration-contract/wire.md
index 133d9d1e2..90908c917 100644
--- a/docs/integration-contract/wire.md
+++ b/docs/integration-contract/wire.md
@@ -1834,3 +1834,49 @@ working/pending row collapses during voice; on short screens it hides first when
 needed to retain transcript space. Cards remain in the existing scrolling Chat
 transcript. No live recognition, latency, echo or exact permission-speech
 qualification is implied; #961 owns the bounded provider/device measurements.
+
+### Conversation permission fallback (#114)
+
+The shipped SDK client declares `client_hello.capabilities.toolResolution: true`.
+The React conversation owner consumes scoped `tool_resolution` frames before
+ordinary chat dispatch. A host `permission_denied` activity event from a current,
+authorized voice-posture turn publishes one `denied` outcome with the fixed
+reason `voice_posture`; this is a posture refusal, not a user decision, and it
+raises no approval card. It uses the existing bounded host outcome ledger.
+
+Pending ordinary-turn approvals retain their visual grant controls. A refusal
+matches original, attributed user input only while approvals are pending in the
+selected session's current turn. A phrase-like `brain, stop` candidate snapshots
+that turn's pending requests and sends the existing `tool_denial` with explicit
+`turnId` and `channel: "voice"`. Partial, missing-confidence or unproven-isolation
+candidates are treated as ambiguous. Bare stop/no/cancel and affirmatives remain
+ordinary input. Assistant/output transcripts and unknown-origin input never
+invoke the detector. Both built-in adapters retain their unproven attribution
+profiles; manual review is not evidence authorizing a spoken decision.
+
+Sending a refusal locks only the affected controls and says `Refusal sent ·
+checking`. It never claims host confirmation. A correlated host outcome reports
+denied, the actual winning screen grant, expired, or unknown. Disconnect stops
+capture and retains uncertainty; it never queues an old denial for a replacement
+request. Host terminal state reconciles unanswered requests without depending on
+`tool_result`. Receipts remain readable if reconnect replaces the transcript.
+
+Neither built-in adapter has a proven deterministic exact-copy permission audio
+path. The approved fallback therefore uses a local earcon, the existing card and
+a 40px strip line. Permission scripts and confirmed outcome wording are visual
+only: they are never submitted as model commentary or to a separate TTS service.
+Labels come only from bounded static registry labels (four words at most), with
+`An action` as the generic fallback. Payloads and unproven effect descriptions
+never enter those scripts. Cues wait for quiet, survive duplicate/reconnect
+identities without repeating, and are dropped if the request resolves first.
+Earcons use the existing PCM owner; speech over an earcon keeps recognition live.
+Headphones/isolation limitations remain visible in the entry disclosure.
+
+The local permission view retains at most 128 records and 4096 once-only cue
+identities. If pending records exhaust the bound, capture closes and the screen
+remains the decision surface; a partial snapshot is never silently denied.
+At 320 × 568, shared-row summaries hide first; with review and a refusal line,
+the controls' eight pixels of empty vertical space give way while every target
+stays at least 44px and the transcript retains 264px. Real speaker/headphone
+listening, recognition, echo and latency qualification remain human/device
+verification under #114 and #961.
diff --git a/docs/investigations/live-conversation-investigation.md b/docs/investigations/live-conversation-investigation.md
index 1e30f210e..b44ec7b1b 100644
--- a/docs/investigations/live-conversation-investigation.md
+++ b/docs/investigations/live-conversation-investigation.md
@@ -288,7 +288,7 @@ is unknown, not queued against a replacement request.
 Terminal state invalidates every pending exchange for that turn without waiting
 for `tool_result`. Current client terminal handling finishes the assistant
 message and resyncs; its message-state helper only marks streaming false
-(`finishAssistantMessage`, `packages/ui-react/src/stores/chat-state.ts:1800-1805`).
+(`finishAssistantMessage`, `packages/ui-react/src/stores/chat-state.ts:1818-1823`).
 This observation is a required integration check, not proof that all cards
 currently clear. A host terminal event plus local audio drain/discard defines
 conversation completion; provider turn/audio end does not.
diff --git a/docs/plans/navigation-recovery.md b/docs/plans/navigation-recovery.md
index 2ead02b74..27d9d06a0 100644
--- a/docs/plans/navigation-recovery.md
+++ b/docs/plans/navigation-recovery.md
@@ -361,15 +361,15 @@ implementation. Any PR moving these lines owns their citation repairs.
 
 - Welcome alternatives: (`label="Start with"`, `packages/ui-react/src/components/chat/welcome-state.tsx:46-55`).
 
-- Session selection: (`const handleSessionResume = useCallback(`, `packages/ui-react/src/components/chat/chat-page.tsx:451-458`).
+- Session selection: (`const handleSessionResume = useCallback(`, `packages/ui-react/src/components/chat/chat-page.tsx:452-459`).
 
-- New chat: (`{hasMessages && !wide && (`, `packages/ui-react/src/components/chat/chat-page.tsx:656-663`).
+- New chat: (`{hasMessages && !wide && (`, `packages/ui-react/src/components/chat/chat-page.tsx:657-664`).
 
-- Buffer eviction: (`function evictStale(`, `packages/ui-react/src/stores/chat-state.ts:1079-1095`).
+- Buffer eviction: (`function evictStale(`, `packages/ui-react/src/stores/chat-state.ts:1083-1099`).
 
 - Root namespace: (`const prefix = options.storagePrefix ??`, `packages/ui-react/src/root.ts:182-237`).
 
-- Clear transcript selection: (`clearMessages: () => {`, `packages/ui-react/src/stores/chat-state.ts:2104-2113`).
+- Clear transcript selection: (`clearMessages: () => {`, `packages/ui-react/src/stores/chat-state.ts:2122-2131`).
 
 - Composer draft/acknowledgement: [`const [input, setInput] = useState("");`](https://github.com/schlessera/brain-kit/blob/7bfdc71074f4ff6243e0d7133e83dbb36eb2a971/packages/ui-react/src/components/chat/composer.tsx#L62-L85), before #951 moved the draft into the root's draft store (`stores/draft-state.ts`).
 
@@ -401,7 +401,7 @@ implementation. Any PR moving these lines owns their citation repairs.
 
 - Queued acceptance: (`// Queue it as the session's next turn; report queued immediately.`, `packages/ui-server/src/ws/run-session.ts:936-981`).
 
-- Approval target: (`function mutateLastAssistant(`, `packages/ui-react/src/stores/chat-state.ts:1220-1250`).
+- Approval target: (`function mutateLastAssistant(`, `packages/ui-react/src/stores/chat-state.ts:1224-1254`).
 
 ## Bounded follow-up ownership
 
diff --git a/packages/ui-react/src/components/chat/chat-page.tsx b/packages/ui-react/src/components/chat/chat-page.tsx
index 53eab161d..4f3869492 100644
--- a/packages/ui-react/src/components/chat/chat-page.tsx
+++ b/packages/ui-react/src/components/chat/chat-page.tsx
@@ -112,6 +112,7 @@ export function ChatPage() {
   const messages = useChatStore((s) => activeChat(s).messages);
   const voiceOutputs = useStore(root.connection.conversation.state, (s) => s.outputs);
   const sessionId = useChatStore((s) => s.activeSessionId);
+  const hasVoicePermission = useStore(root.connection.conversation.permissions.state, s => s.records.some(r => r.sessionId === sessionId && !!r.word));
   const hasVoiceOutput = voiceOutputs.some((output) => output.sessionId === sessionId && output.generated);
 
   const clearMessages = useChatStore((s) => s.clearMessages);
@@ -666,7 +667,7 @@ export function ChatPage() {
                 <div className="px-4 md:px-6"><div {...{ [READING_COLUMN_ATTR]: "" }} className="mx-auto max-w-3xl"><UnconfirmedSends /></div></div>
                 <RestorationState onNewChat={clearMessages} />
               </div>
-            ) : messages.length === 0 && !hasVoiceOutput ? (
+            ) : messages.length === 0 && !hasVoiceOutput && !hasVoicePermission ? (
               <div ref={welcomeRef} className="h-full overflow-y-auto" data-welcome="">
                 <div className="px-4 pt-3 md:px-6">
                   <DigestCard />
diff --git a/packages/ui-react/src/components/chat/policy-change-card.tsx b/packages/ui-react/src/components/chat/policy-change-card.tsx
index e2518d789..df9f05058 100644
--- a/packages/ui-react/src/components/chat/policy-change-card.tsx
+++ b/packages/ui-react/src/components/chat/policy-change-card.tsx
@@ -54,8 +54,9 @@ export function PolicyChangeCard({ toolCall, onApproval }: {
   useLayoutEffect(() => {
     if (explicit.current && (busy || review.state !== "pending")) { explicit.current = false; receipt.current?.focus({ preventScroll: true }); }
   }, [busy, review.state]);
+  const voiceLocked = toolCall.voicePermission && toolCall.voicePermission.phase !== "pending";
   function decide(approved: boolean) {
-    if (!verified || !current() || busy || sent.current || review.state !== "pending" || !onApproval) return;
+    if (voiceLocked || !verified || !current() || busy || sent.current || review.state !== "pending" || !onApproval) return;
     sent.current = true;
     if (onApproval(toolCall.id, approved) === false) { sent.current = false; return; }
     explicit.current = true; setBusy(true); setReader(false);
@@ -72,7 +73,7 @@ export function PolicyChangeCard({ toolCall, onApproval }: {
     <p className="text-xs">{review.bodyChanged ? "Body text changed." : "Body text unchanged."}</p>
     {review.bodyChanged && <div className="[&_[role=button]]:min-h-11"><Disclosure label="Read body diff"><div className="max-h-80 min-w-0 overflow-auto"><DiffBlock tinted variant="inset" text={review.bodyDiff} /></div></Disclosure></div>}
   </>;
-  const pending = review.state === "pending" && !busy;
+  const pending = review.state === "pending" && !busy && !voiceLocked;
   return <div data-policy-change data-policy-state={review.state} className="min-w-0 space-y-2 text-foreground" style={{ overflowWrap: "anywhere" }}>
     {pending ? <div data-approval-card role="group" aria-label="Policy change proposed">
       <ApprovalCard tool="Policy change proposed" target={review.path} badge="Review policy" wrapHeader wrapActions diff="" risk=""
@@ -87,7 +88,7 @@ export function PolicyChangeCard({ toolCall, onApproval }: {
       </ApprovalCard>
       <span className="sr-only" role="status">Policy change proposed. Review before approving.</span>
     </div> : <div ref={receipt} tabIndex={-1} data-policy-receipt className="rounded-md border border-border-subtle p-3 outline-none focus-visible:ring-2 focus-visible:ring-primary/50">
-      <p role="status" className="text-sm">{busy ? review.message : readError || review.message}</p>
+      <p role="status" className="text-sm">{voiceLocked ? toolCall.voicePermission?.word : busy ? review.message : readError || review.message}</p>
       <p className="font-mono text-xs">{review.state === "updated" ? `${review.baseHash ?? "defaults"} → ${review.proposedHash}` : `Based on ${review.baseHash ?? "no policy file"}`}</p>
       {review.state === "updated" && <Button label="View policy" tone="quiet" size="md" style={{ minHeight: 44 }} onClick={() => { const opener = document.activeElement; if (opener instanceof HTMLElement) openFile(opener, opener.matches(":focus-visible")); }} />}
       {!busy && (review.state === "unknown" || readError) && <Button label="Check again" tone="quiet" size="md" style={{ minHeight: 44 }} onClick={() => { explicit.current = true; void check(); }} />}
diff --git a/packages/ui-react/src/components/chat/tool-call-timeline.tsx b/packages/ui-react/src/components/chat/tool-call-timeline.tsx
index 9860e1b6b..28a33a6b6 100644
--- a/packages/ui-react/src/components/chat/tool-call-timeline.tsx
+++ b/packages/ui-react/src/components/chat/tool-call-timeline.tsx
@@ -344,7 +344,7 @@ function ToolCallEntryView({
             </span>
           )}
           {/* A closed card's word replaces "Approval needed": it needs nothing. */}
-          {!(closed && toolCall.status === "pending_approval") && (
+          {!(closed && toolCall.status === "pending_approval") && !toolCall.voicePermission?.word && (
             <StatusIndicator status={toolCall.status} isError={toolCall.isError} />
           )}
         </span>
@@ -361,6 +361,8 @@ function ToolCallEntryView({
         </p>
       )}
 
+      {toolCall.voicePermission?.word && <p data-voice-permission-receipt="" className="px-2 text-xs text-foreground">{toolCall.voicePermission.word}{toolCall.voicePermission.heardAt && <span> · heard “brain, stop” · {new Date(toolCall.voicePermission.heardAt).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })}</span>}</p>}
+
       {/* Live subagent state for tool fan-outs, fed by the activity stream. */}
       {renderer.subagentRows && <SubagentEntryRows agentToolUseId={toolCall.id} />}
 
diff --git a/packages/ui-react/src/components/voice/conversation-outputs.tsx b/packages/ui-react/src/components/voice/conversation-outputs.tsx
index 2eed68fe5..fe91af380 100644
--- a/packages/ui-react/src/components/voice/conversation-outputs.tsx
+++ b/packages/ui-react/src/components/voice/conversation-outputs.tsx
@@ -6,7 +6,10 @@ import { TurnHeader } from "../chat/transcript-turn.js";
 export function ConversationOutputs({ sessionId }: { sessionId: string | null }) {
   const root = useBrainUiRoot();
   const outputs = useStore(root.connection.conversation.state, (state) => state.outputs);
-  return <>{outputs.filter((output) => output.sessionId === sessionId && output.generated).map((output) =>
+  const permission = useStore(root.connection.conversation.permissions.state);
+  const buffer = useStore(root.stores.chat, state => sessionId === null ? state.draft : state.buffers[sessionId]);
+  const tools = buffer?.messages.flatMap(m => m.toolCalls) ?? [];
+  return <>{permission.records.filter(r => r.sessionId === sessionId && r.word && (r.postureDenied || r.heardAt && !tools.some(t => t.id === r.toolUseId))).map(r => <p key={`posture:${r.turnId}:${r.toolUseId}`} data-voice-posture-outcome={r.postureDenied ? "" : undefined} data-voice-permission-outcome="" className="py-2 text-xs">{r.word}</p>)}{outputs.filter((output) => output.sessionId === sessionId && output.generated).map((output) =>
     <div key={`${output.conversationId}:${output.epoch}:${output.outputId}`} className="py-4" data-conversation-output="">
       <TurnHeader who="Brain" tone="brain" />
       <p className="whitespace-pre-wrap">{output.generated}</p>
diff --git a/packages/ui-react/src/components/voice/conversation-strip.tsx b/packages/ui-react/src/components/voice/conversation-strip.tsx
index ed571290a..2398327bf 100644
--- a/packages/ui-react/src/components/voice/conversation-strip.tsx
+++ b/packages/ui-react/src/components/voice/conversation-strip.tsx
@@ -1,3 +1,4 @@
+import { useMediaQuery } from "../../hooks/use-media-query.js";
 import { useEffect, useRef } from "react";
 import { useStore } from "zustand";
 import { Button, Overlay } from "@schlessera/brain-ui-kit";
@@ -8,6 +9,8 @@ export function ConversationStrip({ backend, onLeave }: { backend: string; onLea
   const root = useBrainUiRoot();
   const client = root.connection.conversation;
   const s = useStore(client.state);
+  const permission = useStore(client.permissions.state);
+  const shortScreen = useMediaQuery("(max-height: 580px)");
   const chat = useStore(root.stores.connection, (state) => state.wsStatus);
   const needsScreen = useStore(root.stores.chat, (state) => {
     const exchange = (s.sessionId === null ? state.draft : state.buffers[s.sessionId])?.askUser;
@@ -53,7 +56,8 @@ export function ConversationStrip({ backend, onLeave }: { backend: string; onLea
         <Button label="Discard" tone="ghost" style={button} onClick={client.discard} />
       </div>
     </div>}
-    <div style={{ height: 52, display: "flex", alignItems: "center", gap: 4 }}>
+    {permission.line && <div data-voice-refusal-window="" className="text-destructive" style={{ height: 40, fontSize: 12 }}>{permission.line}</div>}
+    <div style={{ height: permission.line && s.text && shortScreen ? 44 : 52, display: "flex", alignItems: "center", gap: 4 }}>
       <Button label={s.micOn ? "Mute mic" : s.connection === "Connected" ? "Unmute mic" : "Resume"} ariaLabel={s.micOn ? "Mute mic" : "Resume microphone"} tone="ghost" style={button} onClick={s.micOn ? client.mute : client.resume} />
       {s.playing && <Button label="Stop reply" tone="ghost" style={button} onClick={client.stopReply} />}
       <Button label="Leave voice" tone="ghost" style={button} onClick={leave} />
diff --git a/packages/ui-react/src/hooks/websocket-handlers/connection.ts b/packages/ui-react/src/hooks/websocket-handlers/connection.ts
index 74147a6d6..776c3f29f 100644
--- a/packages/ui-react/src/hooks/websocket-handlers/connection.ts
+++ b/packages/ui-react/src/hooks/websocket-handlers/connection.ts
@@ -38,9 +38,8 @@ export const connectionFrameHandlers = {
   inbox_delta: (msg, context) => {
     context.stores.inbox.getState().applyDelta(msg);
   },
-  // Live conversation (#957) is negotiated: a host sends these only to a
-  // connection that started a conversation or declared toolResolution, and
-  // this client does neither yet (capture/playback is #960).
+  // Root-owned conversation routing consumes permission outcomes before demux;
+  // ordinary chat progress keeps its existing handlers.
   tool_resolution: () => {},
   // Pending follow-ups (#1002) are consumed by the connection before demux.
   session_queue: () => {},
diff --git a/packages/ui-react/src/stores/chat-state.ts b/packages/ui-react/src/stores/chat-state.ts
index 84da414ca..70923b5a3 100644
--- a/packages/ui-react/src/stores/chat-state.ts
+++ b/packages/ui-react/src/stores/chat-state.ts
@@ -1,3 +1,4 @@
+import type { VoicePermissionReceipt } from "../voice/conversation-permissions.js";
 import { POLICY_CHANGE_REVIEW_SCHEMA, type PolicyChangeReview } from "@schlessera/brain-ui-sdk/tool-contracts";
 import { createStore } from "zustand/vanilla";
 import { rewriteLinkDestinations } from "@schlessera/brain-ui-sdk/internal/client";
@@ -139,6 +140,8 @@ export interface MessageAttachment {
 }
 
 export interface ToolCall {
+  /** Local voice dispatch and host-confirmed permission evidence. */
+  voicePermission?: VoicePermissionReceipt;
   policyChange?: PolicyChangeReview;
   id: string;
   name: string;
@@ -495,6 +498,7 @@ export interface ChatState {
     /** The host turn the request belongs to, from the frame. */
     turnId?: string
   ) => void;
+  applyVoicePermission: (receipt: VoicePermissionReceipt) => void;
   resolveToolApproval: (key: ChatKey, toolUseId: string, approved: boolean) => void;
   /**
    * Make restored approval cards read-only, each with the host fact that
@@ -1072,7 +1076,7 @@ export function pendingApprovals(state: Pick<ChatState, "buffers" | "draft">): A
  * closure (#1072) has made it read-only.
  */
 export function awaitsDecision(tool: ToolCall): boolean {
-  return tool.status === "pending_approval" && !tool.readOnly;
+  return tool.status === "pending_approval" && !tool.readOnly && (!tool.voicePermission || tool.voicePermission.phase === "pending");
 }
 
 /** Evict least-recently-touched non-active buffers beyond MAX_BUFFERS. */
@@ -1560,6 +1564,20 @@ export function createChatStore(env: StoreEnvironment, provider: StoreApi<Provid
           return { messages: msgs };
         }),
 
+      applyVoicePermission: (receipt) => {
+        const key = receipt.sessionId;
+        const chat = get().buffers[key];
+        const owns = (m: ChatMessage, t: ToolCall) => t.id === receipt.toolUseId && (t.approvalTurnId ?? m.turnId ?? m.streamTurnId) === receipt.turnId;
+        if (!chat?.messages.some(m => m.toolCalls.some(t => owns(m, t) && t.voicePermission !== receipt))) return;
+        mutateBuffer(key, current => ({ messages: current.messages.map(m => ({ ...m, toolCalls: m.toolCalls.map(t => {
+          if (!owns(m, t)) return t;
+          // Receipt state locks decisions through awaitsDecision. Preserve the
+          // transcript status so ordinary result/recovery routing can still
+          // recognize an unanswered restored card and record its closure.
+          return { ...t, voicePermission: receipt };
+        }) })) }));
+      },
+
       resolveToolApproval: (key, toolUseId, approved) =>
         mutateToolHolder(key, toolUseId, (last) => ({
           ...last,
diff --git a/packages/ui-react/src/voice/conversation-client.ts b/packages/ui-react/src/voice/conversation-client.ts
index 8cbe25942..5d854f98a 100644
--- a/packages/ui-react/src/voice/conversation-client.ts
+++ b/packages/ui-react/src/voice/conversation-client.ts
@@ -1,3 +1,4 @@
+import { createConversationPermissions } from "./conversation-permissions.js";
 import { createStore } from "zustand/vanilla";
 import type { ClientMessage, ServerMessage, ServerConversationOpened, ConversationWireEvent, ConversationWorkReceipt, ConversationOutputRecord } from "@schlessera/brain-ui-sdk/protocol";
 import type { BrainUiServices } from "../root.js";
@@ -60,8 +61,18 @@ export function createConversationClient(root: BrainUiServices, send: (message:
   const scope = () => state.getState().profile;
   const current = (own: number) => !disposed && state.getState().active && own === generation;
   const announce = (announcement: string) => state.setState({ announcement });
+  const localTones = new Set<string>();
   let playback = makePlayback();
+  const permissions = createConversationPermissions(root, send, () => ({ active: state.getState().active, sessionId: state.getState().sessionId, micOn: state.getState().micOn, isolated: scope()?.capabilities.echoIsolatedInput === "supported", quiet: !state.getState().micOn || ended && !hold }), () => {
+    playback.cut();
+    const outputId = crypto.randomUUID(); localTones.add(outputId);
+    const bytes = new Uint8Array(12000); const view = new DataView(bytes.buffer);
+    for (let i = 0; i < bytes.length / 2; i++) view.setInt16(i * 2, Math.sin(i * 2 * Math.PI * 660 / 24000) * 1600 * Math.sin(i * Math.PI / (bytes.length / 2)), true);
+    playback.enqueue(outputId, bytes, { encoding: "pcm16", channels: 1, sampleRate: 24000 });
+    playback.quiet(true);
+  }, () => { pause(); state.setState({ notice: "Too many pending approvals. Use Deny on screen." }); });
   function makePlayback() { return createConversationPlayback((outputId, playbackState) => {
+    if (localTones.has(outputId)) return;
     const profile = scope();
     if (profile) {
       updateOutput(profile.epoch, outputId, { playback: playbackState });
@@ -90,8 +101,9 @@ export function createConversationClient(root: BrainUiServices, send: (message:
     const question = buffer?.askUser;
     const answering = question && !question.cancelled && !question.answers && !question.order && !question.formAnswers && question.questions.length === 1 && !question.list && !question.rank && !question.form;
     if (stopFence && ready && resync === 0 && !working) stopFence = false;
-    state.setState({ playing: playback.playing(), interaction: stopFence ? "Checking whether the reply stopped"
-      : playback.playing() ? "Speaking" : answering ? "Answering question" : s.text ? (hold ? "Sending soon" : "Review before sending") : working || playback.pending() ? "Working" : "Listening" });
+    const playing = playback.playingIds().some(id => !localTones.has(id));
+    state.setState({ playing, interaction: stopFence ? "Checking whether the reply stopped"
+      : playing ? "Speaking" : answering ? "Answering question" : s.text ? (hold ? "Sending soon" : "Review before sending") : working || playback.pending() ? "Working" : "Listening" });
   }
   function clearTimers() { clearTimeout(silence); clearTimeout(hold); clearTimeout(finalization); silence = hold = finalization = undefined; }
   function stopMic() { mic?.stop(); mic = undefined; state.setState({ micOn: false }); }
@@ -118,6 +130,7 @@ export function createConversationClient(root: BrainUiServices, send: (message:
   }
   function pause(lost = false, resumable = true, notify = true) {
     generation++; state.setState({ token: generation });
+    permissions.lost();
     clearTimers();
     stopMic();
     saveDraft();
@@ -156,7 +169,8 @@ export function createConversationClient(root: BrainUiServices, send: (message:
         finalAfterSpeech = false;
         lastSpeech = performance.now();
         clearTimeout(hold); hold = undefined;
-        if (playback.playing()) { stopReply(); return; }
+        if (playback.playingIds().some(id => !localTones.has(id))) { stopReply(); return; }
+        if (playback.playing()) playback.cut();
         playback.quiet(false);
         if (!utterance || ended) { if (capturedInputs.size >= 4096) { pause(true); state.setState({ notice: "Restart voice to continue this long conversation." }); return; } utterance = crypto.randomUUID(); capturedInputs.add(utterance); ended = false; }
         clearTimeout(silence);
@@ -181,6 +195,7 @@ export function createConversationClient(root: BrainUiServices, send: (message:
     send({ type: "conversation_endpoint", conversationId: profile.conversationId, epoch: profile.epoch, utteranceId: utterance });
     playback.quiet(!trustworthy());
     maybeHold(own);
+    permissions.quiet();
     const endedUtterance = utterance;
     finalization = setTimeout(() => {
       if (!current(own)) return;
@@ -232,6 +247,7 @@ export function createConversationClient(root: BrainUiServices, send: (message:
   }
   let inputFormat: Extract<ConversationWireEvent, { kind: "ready" }>["input"] | undefined;
   function frame(message: ServerMessage): ServerMessage | null {
+    permissions.frame(message);
     if (message.type === "server_hello") state.setState({ available: message.capabilities?.liveConversation === true && message.capabilities?.conversationPause === true });
     if (message.type === "session_info" && message.requestId && requests.has(message.requestId)) {
       const request = requests.get(message.requestId)!;
@@ -306,6 +322,11 @@ export function createConversationClient(root: BrainUiServices, send: (message:
     if (!ready) return null;
     if (event.kind === "input_fragment") {
       if (!capturedInputs.has(event.utteranceId) || retiredInputs.has(event.utteranceId)) return null;
+      if (permissions.input(event)) {
+        retiredInputs.add(event.utteranceId); fragments.delete(event.utteranceId); lastInput = undefined;
+        state.setState({ text: [...fragments.values()].flatMap(items => [...items.values()].map(f => f.text)).join(" ").trim() });
+        saveDraft(); refresh(); return null;
+      }
       const items = fragments.get(event.utteranceId) ?? new Map();
       if (event.certainty !== "known" || event.origin !== "user" || (event.confidence ?? 0) < 0.9) manualReview.add(event.utteranceId);
       finalAfterSpeech = event.finalization === "final";
@@ -338,9 +359,9 @@ export function createConversationClient(root: BrainUiServices, send: (message:
   });
   const hidden = () => { if (document.hidden && state.getState().active) pause(); else if (state.getState().active && !requested) startEpoch(); };
   if (typeof document !== "undefined") document.addEventListener("visibilitychange", hidden);
-  const unwatchAuth = root.authLock.registerStop(async () => { leave(); requests.clear(); restoredRequests.clear(); openingId = undefined; requested = false; agreedDisclosure = undefined; stopFence = false; state.setState({ profile: null, work: {}, outputs: [], available: false }); });
+  const unwatchAuth = root.authLock.registerStop(async () => { leave(); requests.clear(); restoredRequests.clear(); openingId = undefined; requested = false; agreedDisclosure = undefined; stopFence = false; permissions.clear(); localTones.clear(); state.setState({ profile: null, work: {}, outputs: [], available: false }); });
   return {
-    state, frame,
+    state, frame, permissions,
     enter() {
       if (disposed || state.getState().active || root.stores.voice.getState().mode !== "idle" || root.stores.voice.getState().local !== "idle") return;
       const sessionId = root.stores.chat.getState().activeSessionId;
@@ -350,12 +371,12 @@ export function createConversationClient(root: BrainUiServices, send: (message:
       state.setState({ active: true, sessionId, agentProviderId, profile: null, work: {}, connection: "Connecting", disclosureOpen: true, text: "", notice: "", interaction: "Listening" });
       stopFence = false;
       root.stores.voice.getState().setMode("conversation");
-      consent = false; startEpoch();
+      consent = false; startEpoch(); permissions.refresh();
     },
     start() { const profile = scope(); if (!profile) return; agreedDisclosure = disclosureKey(profile); consent = true; state.setState({ disclosureOpen: false }); void capture(); },
     details() { state.setState({ disclosureOpen: true }); },
     resume() { if (state.getState().disclosureOpen) return; if (ready && !stopFence) { consent = true; state.setState({ interaction: "Listening" }); void capture(); } else startEpoch(); },
-    mute() { clearTimers(); endpoint(generation); stopMic(); playback.quiet(true); announce("Microphone off"); },
+    mute() { clearTimers(); endpoint(generation); stopMic(); playback.quiet(true); permissions.refresh(); announce("Microphone off"); },
     commit,
     discard() { clearTimers(); removeSavedDraft(); fragments.clear(); lastInput = undefined; state.setState({ text: "" }); refresh(); },
     stopReply, leave,
diff --git a/packages/ui-react/src/voice/conversation-pcm.ts b/packages/ui-react/src/voice/conversation-pcm.ts
index 1b1cfbbbb..aae9bfa68 100644
--- a/packages/ui-react/src/voice/conversation-pcm.ts
+++ b/packages/ui-react/src/voice/conversation-pcm.ts
@@ -118,6 +118,7 @@ export function createConversationPlayback(report: (outputId: string, state: Con
     quiet(value: boolean) { blocked = !value; pump(); },
     pending: () => waiting.length > 0 || live.size > 0,
     playing: () => live.size > 0,
+    playingIds: () => [...new Set(live.values())],
     cut() {
       generation++;
       const ids = new Set([...live.values(), ...waiting.map((chunk) => chunk.outputId)]);
diff --git a/packages/ui-react/src/voice/conversation-permissions.ts b/packages/ui-react/src/voice/conversation-permissions.ts
new file mode 100644
index 000000000..9c41b840b
--- /dev/null
+++ b/packages/ui-react/src/voice/conversation-permissions.ts
@@ -0,0 +1,129 @@
+import { createStore } from "zustand/vanilla";
+import type { ClientMessage, ConversationWireEvent, ServerMessage } from "@schlessera/brain-ui-sdk/protocol";
+import type { BrainUiServices } from "../root.js";
+
+export interface VoicePermissionReceipt {
+  sessionId: string;
+  turnId: string;
+  toolUseId: string;
+  phase: "pending" | "sent" | "unknown" | "denied" | "granted" | "expired";
+  announced: boolean;
+  ambiguous: boolean;
+  byVoice: boolean;
+  heardAt?: number;
+  script: string;
+  word: string;
+  label?: string;
+  postureDenied?: true;
+}
+
+/** Concrete permission routing. Exact-copy speech is absent, so only a local earcon is queued. */
+export function createConversationPermissions(root: BrainUiServices, send: (message: ClientMessage) => boolean,
+  selected: () => { active: boolean; sessionId: string | null; micOn: boolean; quiet: boolean; isolated: boolean }, earcon: () => void, overflow: () => void) {
+  const state = createStore<{ records: VoicePermissionReceipt[]; line: string }>(() => ({ records: [], line: "" }));
+  const records = new Map<string, VoicePermissionReceipt>();
+  const turns = new Map<string, string>();
+  const announced = new Set<string>();
+  let applying = false;
+  let full = false;
+  const identity = (sessionId: string, turnId: string, toolUseId: string) => JSON.stringify([sessionId, turnId, toolUseId]);
+  const pending = () => {
+    const s = selected();
+    return s.active && s.sessionId ? [...records.values()].filter((r) => r.sessionId === s.sessionId && r.turnId === turns.get(s.sessionId!) && r.phase === "pending") : [];
+  };
+  function apply() {
+    if (applying) return;
+    applying = true;
+    try { for (const receipt of records.values()) root.stores.chat.getState().applyVoicePermission(receipt); }
+    finally { applying = false; }
+  }
+  function publish() {
+    const s = selected();
+    state.setState({ records: [...records.values()], line: full ? "Use Deny on screen; the voice request limit was reached." : pending().length ? s.micOn ? 'Say “brain, stop” to refuse · voice can’t approve' : "Mic is off. Use Deny on screen, or unmute to refuse." : "" });
+    apply();
+  }
+  function put(receipt: VoicePermissionReceipt) {
+    const key = identity(receipt.sessionId, receipt.turnId, receipt.toolUseId);
+    if (!records.has(key) && records.size >= 128) {
+      const old = [...records].find(([, r]) => !["pending", "sent", "unknown"].includes(r.phase));
+      if (!old) { full = true; overflow(); return; }
+      records.delete(old[0]);
+    }
+    records.set(key, receipt);
+  }
+  function quiet() {
+    if (!selected().quiet) return;
+    let tone = false;
+    for (const receipt of pending()) {
+      const key = identity(receipt.sessionId, receipt.turnId, receipt.toolUseId);
+      if (announced.has(key) || announced.size >= 4096) continue;
+      announced.add(key);
+      put({ ...receipt, announced: true, word: "earcon once · voice can’t approve", script: selected().micOn
+        ? `${receipt.label ?? "An action"} needs a decision on screen. Voice can’t approve it. Say “brain, stop” to refuse.`
+        : `${receipt.label ?? "An action"} needs a decision on screen. Mic is off. Use Deny on screen, or unmute to refuse.` });
+      tone = true;
+    }
+    if (tone) earcon();
+    publish();
+  }
+  function frame(message: ServerMessage) {
+    const { sessionId, turnId } = message as { sessionId?: string; turnId?: string };
+    if (!sessionId || !turnId) return;
+    if (message.type === "session_info" || message.type === "text_delta" || message.type === "status" && message.status !== "idle" && message.status !== "cancelled") {
+      if (!turns.has(sessionId) && turns.size >= 128) turns.delete(turns.keys().next().value!);
+      turns.set(sessionId, turnId);
+    }
+    if (message.type === "tool_approval_request") {
+      if (!turns.has(sessionId)) turns.set(sessionId, turnId);
+      const key = identity(sessionId, turnId, message.toolUseId);
+      const previous = records.get(key);
+      const provider = root.stores.provider.getState();
+      const backendId = provider.available.find(p => p.id === (provider.pinnedId ?? provider.selectedId))?.backendId ?? "";
+      let candidate: unknown;
+      try { candidate = root.renderers.resolve({ id: message.toolUseId, name: message.toolName, input: {} }, backendId)?.label; } catch { /* A renderer cannot break the permission transport. */ }
+      const label = typeof candidate === "string" && /^[a-zA-Z][a-zA-Z0-9 -]{0,63}$/.test(candidate) && candidate.trim().split(/\s+/).length <= 4 ? candidate.trim() : "An action";
+      if (!previous) put({ sessionId, turnId, toolUseId: message.toolUseId, label, phase: "pending", announced: false, ambiguous: false, byVoice: false, script: "", word: "" });
+      else if (previous.phase === "unknown") put({ ...previous, phase: "pending", word: "Refusal unconfirmed · request still waiting" });
+      publish(); quiet();
+    } else if (message.type === "tool_resolution") {
+      const key = identity(sessionId, turnId, message.toolUseId);
+      const previous = records.get(key);
+      const phase = message.outcome === "granted" ? "granted" : message.outcome === "expired" ? "expired" : message.outcome === "denied" ? "denied" : "unknown";
+      // A posture denial can have an outcome without ever having a grant card.
+      const byVoice = phase === "unknown" ? previous?.byVoice === true : previous?.heardAt !== undefined && message.channel === "voice";
+      const word = phase === "granted" ? previous?.heardAt ? "The screen decision was already accepted." : "Approved on screen" : phase === "expired" ? "Expired · denied · no answer before the turn ended"
+        : phase === "unknown" ? "Couldn't confirm the refusal" : byVoice ? previous?.ambiguous ? "Denied · by voice · heard unclearly · taken as refusal" : "Denied · by voice"
+        : message.reason === "voice_posture" ? "not done · denied by voice posture · no card" : "Denied on screen";
+      put({ sessionId, turnId, toolUseId: message.toolUseId, announced: previous?.announced ?? false, ambiguous: previous?.ambiguous ?? false, byVoice,
+        ...(previous?.heardAt ? { heardAt: previous.heardAt } : {}), ...(message.reason === "voice_posture" ? { postureDenied: true as const } : {}), label: previous?.label, phase, word,
+        script: phase === "denied" && byVoice ? previous?.ambiguous ? "I couldn't hear that clearly, so I took it as a refusal. The action was denied." : "I took that as a refusal. The action was denied."
+          : phase === "expired" ? "I stopped without doing it. Ask me again when you can look at a screen." : word });
+      publish();
+    } else if (message.type === "result" || message.type === "status" && (message.status === "idle" || message.status === "cancelled")) {
+      for (const receipt of records.values()) if (receipt.sessionId === sessionId && receipt.turnId === turnId && ["pending", "sent"].includes(receipt.phase)) {
+        put({ ...receipt, phase: "expired", word: message.type === "status" && message.status === "cancelled" ? "Cancelled · not done" : "Expired · denied · no answer before the turn ended", script: "I stopped without doing it. Ask me again when you can look at a screen." });
+      }
+      publish();
+    }
+  }
+  function input(event: Extract<ConversationWireEvent, { kind: "input_fragment" }>) {
+    // Unknown attribution is never a user decision. Neither an assistant
+    // transcript nor replayed output can authorize even a scoped denial.
+    if (full || event.origin !== "user" || !/\bbrain[\s,]+st(?:o(?:p)?)?\b/i.test(event.text)) return false;
+    const snapshot = pending();
+    if (!snapshot.length) return false;
+    const ambiguous = !selected().isolated || snapshot.length !== 1 || event.finalization !== "final" || event.certainty !== "known" || (event.confidence ?? 0) < 0.9 || !/^brain[\s,]+stop[.!?\s]*$/i.test(event.text.trim());
+    for (const receipt of snapshot) {
+      const sent = send({ type: "tool_denial", toolUseId: receipt.toolUseId, turnId: receipt.turnId, channel: "voice", message: ambiguous ? 'Heard unclearly; took “brain, stop” as refusal.' : 'Heard “brain, stop”.' });
+      put({ ...receipt, phase: sent ? "sent" : "unknown", ambiguous, byVoice: true, heardAt: Date.now(), word: sent ? "Refusal sent · checking" : "Couldn't confirm the refusal", script: "" });
+    }
+    publish();
+    return true;
+  }
+  const unsubscribe = root.stores.chat.subscribe(apply);
+  return { state, frame, input, quiet, refresh() { publish(); quiet(); },
+    lost() { for (const receipt of records.values()) if (receipt.phase === "sent") put({ ...receipt, phase: "unknown", word: "Couldn't confirm the refusal" }); publish(); },
+    clear() { records.clear(); turns.clear(); announced.clear(); full = false; publish(); },
+    dispose() { unsubscribe(); records.clear(); turns.clear(); announced.clear(); },
+  };
+}
diff --git a/packages/ui-react/tests/browser/conversation.offline.tsx b/packages/ui-react/tests/browser/conversation.offline.tsx
index 0e46846a3..57e9dd2fa 100644
--- a/packages/ui-react/tests/browser/conversation.offline.tsx
+++ b/packages/ui-react/tests/browser/conversation.offline.tsx
@@ -431,3 +431,156 @@ test("a voice-first session binds its original typed draft and generated output,
   expect(s.client.state.getState().sessionId).toBe(null);
   expect(s.ui.stores.drafts.getState().drafts[next]?.text).toBe("New raft question");
 });
+
+function approval(s: Awaited<ReturnType<typeof scene>>, toolUseId: string, sessionId = SESSION, turnId = "ithaca-permission") {
+  s.deliver({ type: "tool_approval_request", sessionId, turnId, toolUseId, toolName: "Write", kind: "tool", input: { file_path: "voyage/raft.md", content: "Private command payload stays on screen" }, description: "Unvetted words must never become approved speech" });
+}
+function recognition(s: Awaited<ReturnType<typeof scene>>, text: string, origin: "user" | "assistant" | "unknown" = "user", confidence = 0.99) {
+  s.event({ kind: "input_fragment", utteranceId: String(s.socket.frames("conversation_audio").at(-1)!.utteranceId), sequence: 0, text, finalization: "final", certainty: "known", confidence, origin });
+}
+
+test("voice refusal: isolated original input sends a scoped denial, locks only its card and awaits the host", async (ctx) => {
+  const s = await scene(ctx); await s.start();
+  s.deliver({ type: "text_delta", sessionId: SESSION, turnId: "ithaca-permission", text: "Checking the raft plan" });
+  approval(s, "ithaca-write");
+  recognition(s, "brain, stop");
+  expect(s.socket.frames("tool_denial"), "a trusted scoped refusal must reach the existing host denial channel").toHaveLength(1);
+  expect(s.socket.frames("tool_denial")[0]).toMatchObject({ toolUseId: "ithaca-write", turnId: "ithaca-permission", channel: "voice" });
+  expect(s.socket.frames("tool_approval")).toHaveLength(0);
+  expect(s.socket.frames("conversation_commit")).toHaveLength(0);
+  await expect.poll(() => s.host.textContent).toContain("Refusal sent · checking");
+  expect(s.ui.stores.chat.getState().buffers[SESSION]?.messages.flatMap(m => m.toolCalls).find(t => t.id === "ithaca-write")?.status, "dispatch is not host-confirmed denial").toBe("pending_approval");
+  s.deliver({ type: "text_delta", sessionId: SESSION, turnId: "ithaca-permission", text: ". Other async work continues." });
+  s.ui.connection.flushChatDeltas();
+  await expect.poll(() => s.host.textContent).toContain("Other async work continues");
+  s.deliver({ type: "tool_resolution", sessionId: SESSION, turnId: "ithaca-permission", toolUseId: "ithaca-write", outcome: "denied", channel: "voice" });
+  await expect.poll(() => s.host.textContent).toContain("Denied · by voice");
+});
+
+test("ambiguous refusal snapshots current-turn approvals only; duplicate input and later arrivals cannot widen it", async (ctx) => {
+  const s = await scene(ctx); await s.start();
+  s.deliver({ type: "text_delta", sessionId: SESSION, turnId: "ithaca-permission", text: "Review the voyage" });
+  approval(s, "ithaca-one"); approval(s, "ithaca-two"); approval(s, "harbour-other", "odysseus-harbour", "harbour-turn");
+  recognition(s, "brain st", "user", 0.2);
+  expect(s.socket.frames("tool_denial"), "the refusal snapshots every current-turn approval and excludes background sessions").toHaveLength(2);
+  expect(s.socket.frames("tool_denial").map((frame) => frame.toolUseId)).toEqual(["ithaca-one", "ithaca-two"]);
+  approval(s, "ithaca-later"); recognition(s, "brain st", "user", 0.2);
+  expect(s.socket.frames("tool_denial")).toHaveLength(2);
+  for (const toolUseId of ["ithaca-one", "ithaca-two"]) s.deliver({ type: "tool_resolution", sessionId: SESSION, turnId: "ithaca-permission", toolUseId, outcome: "denied", channel: "voice" });
+  await expect.poll(() => s.host.textContent).toContain("heard unclearly · taken as refusal");
+});
+
+test("affirmatives, bare stop and unproven acoustic origin can never decide permissions", async (ctx) => {
+  const s = await scene(ctx); await s.start(); approval(s, "ithaca-safe");
+  for (const text of ["yes", "approve", "go ahead", "brain allow", "always allow", "stop", "no", "cancel"]) recognition(s, text);
+  recognition(s, "brain, stop", "assistant"); recognition(s, "brain, stop", "unknown");
+  expect(s.socket.frames("tool_denial")).toHaveLength(0);
+  expect(s.socket.frames("tool_approval")).toHaveLength(0);
+  expect(s.client.state.getState().text).toBe("brain, stop");
+});
+
+test("outside a refusal window the phrase stays ordinary review text", async (ctx) => {
+  const s = await scene(ctx); await s.start(); recognition(s, "brain, stop");
+  expect(s.socket.frames("tool_denial")).toHaveLength(0);
+  expect(s.client.state.getState().text).toBe("brain, stop");
+});
+
+test("permission fallback: one native earcon waits for quiet, never reads payload, and user refusal works during it", async (ctx) => {
+  const mic = controlledMicrophone(ctx);
+  const descriptor = Object.getOwnPropertyDescriptor(BaseAudioContext.prototype, "createBufferSource")!;
+  const original = descriptor.value as BaseAudioContext["createBufferSource"];
+  const live: AudioBufferSourceNode[] = [];
+  Object.defineProperty(BaseAudioContext.prototype, "createBufferSource", { ...descriptor, value: function(this: BaseAudioContext) { const source = original.call(this); live.push(source); return source; } });
+  ctx.onTestFinished(() => { Object.defineProperty(BaseAudioContext.prototype, "createBufferSource", descriptor); });
+  const s = await scene(ctx); await s.start();
+  approval(s, "ithaca-announcement"); approval(s, "ithaca-announcement");
+  expect(live).toHaveLength(0);
+  mic.quiet();
+  await expect.poll(() => live.length).toBe(1);
+  const receipt = s.client.permissions.state.getState().records[0]!;
+  expect(receipt.announced).toBe(true);
+  approval(s, "ithaca-announcement");
+  expect(live, "a pending duplicate after its earcon never announces twice").toHaveLength(1);
+  expect(receipt.script).not.toMatch(/raft\.md|Private command|Unvetted/);
+  let ended = false; live[0]!.addEventListener("ended", () => { ended = true; });
+  expect(ended).toBe(false);
+  const beforeSpeech = s.socket.frames("conversation_audio").length;
+  mic.speak();
+  await expect.poll(() => s.socket.frames("conversation_audio").length > beforeSpeech || !s.client.state.getState().micOn).toBe(true);
+  expect(s.client.state.getState().micOn, "speaking over the permission earcon keeps the recognizer capture open").toBe(true);
+  recognition(s, "brain, stop", "assistant");
+  expect(s.socket.frames("tool_denial")).toHaveLength(0);
+  recognition(s, "brain, stop", "user");
+  expect(s.socket.frames("tool_denial")).toHaveLength(1);
+  expect(s.client.state.getState().micOn).toBe(true);
+  approval(s, "ithaca-announcement");
+  s.client.mute();
+  expect(live).toHaveLength(1);
+  expect(s.socket.frames("conversation_commit")).toHaveLength(0);
+});
+
+test("a resolved queued announcement is dropped; terminal expiry without tool_result makes controls inert", async (ctx) => {
+  const s = await scene(ctx); await s.start(); approval(s, "ithaca-expiry");
+  const receipt = () => s.client.permissions.state.getState().records.find(r => r.toolUseId === "ithaca-expiry")!;
+  expect(receipt().announced).toBe(false);
+  s.deliver({ type: "result", sessionId: SESSION, turnId: "ithaca-permission", durationMs: 1, numTurns: 1, isError: false });
+  expect(receipt().phase).toBe("expired");
+  s.client.mute();
+  expect(receipt().announced).toBe(false);
+  expect(s.socket.frames("tool_denial")).toHaveLength(0);
+  await expect.poll(() => s.host.textContent).toContain("Expired · denied");
+  expect(s.host.querySelector('[data-approval-card]')).toBe(null);
+});
+
+test("a visual grant winning a voice-refusal race reports the host grant instead of an invented denial", async (ctx) => {
+  const s = await scene(ctx); await s.start(); approval(s, "ithaca-race");
+  recognition(s, "brain, stop");
+  s.deliver({ type: "tool_resolution", sessionId: SESSION, turnId: "ithaca-permission", toolUseId: "ithaca-race", outcome: "granted", channel: "card" });
+  const receipt = s.client.permissions.state.getState().records[0]!;
+  expect(receipt.phase).toBe("granted");
+  expect(receipt.byVoice).toBe(false);
+  await expect.poll(() => s.host.textContent).toContain("The screen decision was already accepted.");
+  expect(s.host.textContent).not.toContain("Denied · by voice");
+  // The receipt owns the confirmed decision; the ordinary tool result still
+  // owns transcript status and restored-card recovery.
+  expect(s.host.querySelector('[data-approval-card]')).toBe(null);
+});
+
+test("a disconnect after refusal keeps the outcome unknown and never resends the old denial", async (ctx) => {
+  const s = await scene(ctx); await s.start(); approval(s, "ithaca-disconnect"); recognition(s, "brain, stop");
+  s.network.drop({ announce: true });
+  await expect.poll(() => s.client.state.getState().micOn).toBe(false);
+  expect(s.client.permissions.state.getState().records[0]?.phase).toBe("unknown");
+  await expect.poll(() => s.host.textContent).toContain("Couldn't confirm the refusal");
+  s.network.recover(); s.ui.connection.reconnectNow();
+  await expect.poll(() => s.network.socket() !== s.socket && s.ui.stores.connection.getState().wsStatus === "connected").toBe(true);
+  expect(s.network.sockets.flatMap(socket => socket.frames("tool_denial"))).toHaveLength(1);
+  s.network.socket()!.deliver({ type: "tool_resolution", sessionId: SESSION, turnId: "ithaca-permission", toolUseId: "ithaca-disconnect", outcome: "denied", channel: "voice" });
+  await expect.poll(() => s.host.textContent).toContain("Denied · by voice");
+  expect(s.client.state.getState().micOn).toBe(false);
+});
+
+test("already-denied voice posture yields one outcome receipt and no card or refusal window", async (ctx) => {
+  const s = await scene(ctx); await s.start();
+  const outcome: ServerMessage & { turnId: string } = { type: "tool_resolution", sessionId: SESSION, turnId: "ithaca-posture", toolUseId: "ithaca-posture", outcome: "denied", reason: "voice_posture" };
+  s.deliver(outcome); s.deliver(outcome);
+  await expect.poll(() => s.host.querySelectorAll('[data-voice-posture-outcome]').length).toBe(1);
+  expect(s.host.textContent).toContain("denied by voice posture · no card");
+  expect(s.host.querySelector('[data-approval-card]')).toBe(null);
+  expect(s.host.querySelector('[data-voice-refusal-window]')).toBe(null);
+  recognition(s, "brain, stop");
+  expect(s.socket.frames("tool_denial")).toHaveLength(0);
+  expect(s.client.state.getState().text).toBe("brain, stop");
+});
+
+for (const theme of ["dark", "light"] as const) test(`permission layout ${theme} 320: review and refusal retain 264px transcript and 44px controls`, async (ctx) => {
+  const s = await scene(ctx, 320, true, theme); await s.start(); approval(s, "ithaca-layout");
+  recognition(s, "Review the departure note");
+  await expect.poll(() => s.host.querySelector('[data-voice-refusal-window]')).not.toBe(null);
+  const strip = s.host.querySelector<HTMLElement>('[data-conversation-strip]')!;
+  const area = [...s.host.querySelectorAll<HTMLElement>('div')].find(element => element.classList.contains("@container"))!;
+  expect(area.getBoundingClientRect().height).toBeGreaterThanOrEqual(264);
+  for (const target of strip.querySelectorAll<HTMLElement>('[role="button"],button')) expect(target.getBoundingClientRect().height).toBeGreaterThanOrEqual(44);
+  expect(strip.scrollWidth).toBeLessThanOrEqual(strip.clientWidth);
+  await page.screenshot({ element: s.host, path: `../../.vitest-attachments/conversation/${theme}-320-permission.png` });
+});
diff --git a/packages/ui-sdk/src/client/ws-client.ts b/packages/ui-sdk/src/client/ws-client.ts
index 92458019a..5ae2f0c74 100644
--- a/packages/ui-sdk/src/client/ws-client.ts
+++ b/packages/ui-sdk/src/client/ws-client.ts
@@ -252,7 +252,7 @@ export class BrainUiClient {
             JSON.stringify({
               type: "client_hello",
               protocolRev: PROTOCOL_REV,
-              capabilities: { [ASK_RECEIPTS_CAPABILITY]: true, [FOLLOW_UP_QUEUE_CAPABILITY]: true },
+              capabilities: { [ASK_RECEIPTS_CAPABILITY]: true, [FOLLOW_UP_QUEUE_CAPABILITY]: true, toolResolution: true },
             })
           );
         } catch {
diff --git a/packages/ui-sdk/tests/ws-client-liveness.test.ts b/packages/ui-sdk/tests/ws-client-liveness.test.ts
index 19505a8df..3ff771524 100644
--- a/packages/ui-sdk/tests/ws-client-liveness.test.ts
+++ b/packages/ui-sdk/tests/ws-client-liveness.test.ts
@@ -123,7 +123,7 @@ function harness(capabilities: Record<string, boolean> = { liveness: true, askRe
 describe("the client hello", () => {
   test("declares receipt support", () => {
     const { sockets, client } = harness();
-    expect(sockets[0]!.frames("client_hello")[0].capabilities).toEqual({ askReceipts: true, followUpQueue: true });
+    expect(sockets[0]!.frames("client_hello")[0].capabilities).toEqual({ askReceipts: true, followUpQueue: true, toolResolution: true });
     client.close();
   });
 });
diff --git a/packages/ui-sdk/tests/ws-client.test.ts b/packages/ui-sdk/tests/ws-client.test.ts
index 2965404b4..ea36b6968 100644
--- a/packages/ui-sdk/tests/ws-client.test.ts
+++ b/packages/ui-sdk/tests/ws-client.test.ts
@@ -316,7 +316,7 @@ describe("the client hello", () => {
       protocolRev: PROTOCOL_REV,
       // Rev 5 (#910): this client reads ask-answer receipts. #1002: and
       // pending follow-up reports.
-      capabilities: { askReceipts: true, followUpQueue: true },
+      capabilities: { askReceipts: true, followUpQueue: true, toolResolution: true },
     });
   });
 });
diff --git a/packages/ui-server/src/ws/bridge.ts b/packages/ui-server/src/ws/bridge.ts
index 91e3ec672..56024bb84 100644
--- a/packages/ui-server/src/ws/bridge.ts
+++ b/packages/ui-server/src/ws/bridge.ts
@@ -384,6 +384,9 @@ export function makeBridge(
     },
     // Always present: a promotion also reaches the live view (#1698).
     activity: (event: Parameters<NonNullable<BackendBridge["activity"]>>[0]) => {
+      if (event.kind === "permission_denied" && work?.posture === "voice" && !signal.aborted && isAuthorized() && turn.turnId === turnId && coordinator.resolvedApprovals.get(event.toolUseId)?.turnId !== turnId) {
+        coordinator.recordApprovalOutcome(event.toolUseId, { outcome: "denied", turnId, sessionId: turn.sessionId, reason: "voice_posture" });
+      }
       if (event.kind === "main_model") {
         if (turn.turnId === turnId && turn.backendStarted && !signal.aborted && !turn.cancelled && event.model
           && (!turn.sessionId || turn.sessionId === event.sessionId)) mainModel?.bind(event.model);
diff --git a/packages/ui-server/tests/ws-conversation.test.ts b/packages/ui-server/tests/ws-conversation.test.ts
index d67a7c425..1cfb4aab0 100644
--- a/packages/ui-server/tests/ws-conversation.test.ts
+++ b/packages/ui-server/tests/ws-conversation.test.ts
@@ -44,6 +44,7 @@ afterEach(() => {
 function setup(options: {
   capabilities?: Parameters<typeof fakeLiveProvider>[0];
   conversation?: boolean;
+  authorized?: boolean;
   holdReturns?: boolean;
   turnTimeoutMs?: number;
   wsRate?: { ratePerSecond: number; burst: number };
@@ -70,6 +71,7 @@ function setup(options: {
   const host = new WsHost({
     registry: createStaticBackendRegistry([backend], backend.id),
     catalog: createSessionCatalog(() => db),
+    ...(options.authorized ? { isPrincipalAuthorized: () => true } : {}),
     ...(options.turnTimeoutMs ? { turnTimeoutMs: options.turnTimeoutMs } : {}),
     ...(options.wsRate ? { wsRate: options.wsRate } : {}),
     ...(options.conversation === false ? {} : { conversationProvider: live.provider }),
@@ -1093,3 +1095,20 @@ test("opening correlation is echoed so an abandoned client's late opening can be
   const resumed = await client.open({ conversationId: conversation.id, requestId: "ithaca-resume" });
   expect(resumed.opened).toMatchObject({ requestId: "ithaca-resume", epoch: 2 });
 });
+
+test("a voice posture denial publishes one host outcome without raising a grant card", async () => {
+  const s = setup({ authorized: true });
+  const client = await s.connect();
+  client.send({ type: "client_hello", protocolRev: 5, capabilities: { toolResolution: true } });
+  const conversation = await client.open();
+  await client.speak(conversation, "u-denied", "Update the raft plan");
+  client.commit(conversation, "u-denied", "r-denied", "Update the raft plan");
+  await until(() => s.turns.length === 1);
+  const event = { kind: "permission_denied" as const, toolUseId: "ithaca-posture-denial", requestKind: "tool" as const, reason: "Voice cannot grant tools." };
+  s.turns[0]!.req.bridge.activity!(event);
+  s.turns[0]!.req.bridge.activity!(event);
+  expect(client.frames("tool_resolution"), "a posture-denied action needs one authoritative outcome, even with no approval card").toHaveLength(1);
+  expect(client.frames("tool_resolution")[0]).toMatchObject({ toolUseId: event.toolUseId, outcome: "denied", reason: "voice_posture", sessionId: s.turns[0]!.sessionId });
+  expect(client.frames("tool_approval_request")).toHaveLength(0);
+  expect(s.host.coordinator.pendingApprovals.size).toBe(0);
+});
diff --git a/scripts/source-browser-dispatch.ts b/scripts/source-browser-dispatch.ts
index 1bb9a3423..2ebd7cb52 100644
--- a/scripts/source-browser-dispatch.ts
+++ b/scripts/source-browser-dispatch.ts
@@ -40,7 +40,7 @@ const declarations=[
       {
         "owner": "packages/ui-react/src/hooks/websocket-handlers/connection.ts",
         "name": "connectionFrameHandlers",
-        "source": "cddde70fb099b570cd6ef20a3bf310ae7edf61ce008d1165a48184bb109fd06c"
+        "source": "6f3e3171dea2792f5cb5d30f268ff471d1d34a062f2e0dbd916c847a8a8f143b"
       },
       {
         "owner": "packages/ui-react/src/hooks/websocket-handlers/handoff.ts",
diff --git a/tests/source-browser-dispatch.test.ts b/tests/source-browser-dispatch.test.ts
index bf84b06ec..bfadbe6d9 100644
--- a/tests/source-browser-dispatch.test.ts
+++ b/tests/source-browser-dispatch.test.ts
@@ -25,7 +25,7 @@ test("audited imports of a different chat helper cannot gain the handler map thr
   expect(sourceBrowserDispatch(root,selected,browserImporters(root,selected)).has(owner)).toBe(false);
 });
 test("registry escape, owner drift and changed imported handler definitions remain unknown",()=>{
-  for(const file of [owner,stats,base+"provider.ts"]){const {root,write}=fixture();write(file,readFileSync(join(root,file),"utf8")+"\n// source drift\n");expect(sourceBrowserDispatch(root,files,browserImporters(root,files)).has(file===stats?stats:owner)).toBe(false);}
+  for(const file of [owner,stats,base+"provider.ts",base+"connection.ts"]){const {root,write}=fixture();write(file,readFileSync(join(root,file),"utf8")+"\n// source drift\n");expect(sourceBrowserDispatch(root,files,browserImporters(root,files)).has(file===stats?stats:owner)).toBe(false);}
   const {root,write}=fixture();write(owner,readFileSync(join(root,owner),"utf8")+"\nexport const escaped=serverMessageHandlers;\n");expect(sourceBrowserDispatch(root,files,browserImporters(root,files)).has(owner)).toBe(false);
 });
 test("unreviewed terminal chat handling cannot gain a trusted dispatch binding",()=>{